GTA VI Phishing Lures, AWS Bedrock Token-Jacking, and Bank-Phishing Cloaking Networks: OTX Credential-Theft Campaign Analysis — Enterprise Detection Pack

---
title: AWS Credential Validation Followed by Bedrock LLM Access Probing
id: 7e4a1b2c-9f3d-4e5a-a1c6-otxbedrock001
status: experimental
description: Detects the KMON_NOC-style validation sequence where GetCallerIdentity is followed by Bedrock ListFoundationModels or InvokeModel calls from identities with no prior Bedrock usage, indicating token-jacking of stolen AWS keys.
author: Security Arsenal Threat Intel
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
date: 2026/11/07
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_bedrock:
        eventSource: bedrock.amazonaws.com
        eventName:
            - ListFoundationModels
            - InvokeModel
            - Converse
    filter_known_automation:
        userIdentity|arn|contains:
            - ':assumed-role/bedrock-pipeline'
            - ':assumed-role/approved-ml-workload'
    condition: selection_bedrock and not filter_known_automation
falsepositives:
    - Legitimate ML engineering teams enumerating foundation models during new project onboarding
level: high
tags:
    - attack.credential_access
    - attack.t1078.004
    - attack.impact
---
title: Bank Phishing Look-Alike Domain Access With Urgency Keyword Pattern
id: 8f5b2c3d-0a4e-5f6b-b2d7-otxbankphish001
status: experimental
description: Detects DNS or web requests to look-alike banking domains using the urgency-keyword naming convention (authorize-, protect-, verify-, secure-, alert-, suspended- prefixes) documented in the 248-domain US financial institution phishing network, including the published OTX indicators.
author: Security Arsenal Threat Intel
references:
    - https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
date: 2026/11/07
logsource:
    category: dns
detection:
    selection_published_iocs:
        query|contains:
            - '53primaryset.com'
            - 'authorize-valley.com'
            - 'commercial-atfirst.com'
            - 'protect-pinnaclefp.com'
    selection_pattern:
        query|re: '(?i)^(authorize|protect|verify|secure|alert|suspended|primary|commercial)-[a-z0-9-]+\.(com|net|org|icu|click)$'
    condition: 1 of selection_*
falsepositives:
    - Legitimate bank marketing subdomains (rare with this hyphenated third-party pattern)
    - Security researchers validating the fake-takedown cloaking behavior
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.credential_access
    - attack.t1078
---
title: GTA VI Themed Phishing Domain Resolution and Dropper Download
id: 9g6c3d4e-1b5f-6g7c-c3e8-otxgta6001
status: experimental
description: Detects resolution of GTA VI pre-release lure domains impersonating the CyberLeek persona and Rockstar Games, including OTX-published indicators and pattern matches on cyberleek/gta6 keyword combinations in newly observed TLDs associated with APK and trojan distribution.
author: Security Arsenal Threat Intel
references:
    - https://www.netcraft.com/blog/how-attackers-are-capitalizing-on-the-hype-around-the-grand-theft-auto-vi-release
date: 2026/11/07
logsource:
    category: dns
detection:
    selection_published_iocs:
        query|contains:
            - 'gta6cyberleek.com'
            - 'cyberleek.click'
            - 'mygta6.icu'
            - 'gta6keycodes.com'
            - 'cyberleek.my'
            - 'contact-rockstargames.com'
            - 'cyberleek.cfd'
            - 'cyberleek.world'
    selection_pattern:
        query|re: '(?i)(cyberleek|gta6|gta-?vi|rockstargames)[a-z0-9-]*\.(icu|click|cfd|world|my|xyz|top)$'
    condition: 1 of selection_*
falsepositives:
    - Fan sites and legitimate gaming news domains on mainstream TLDs (pattern restricted to high-abuse TLDs to compensate)
level: medium
tags:
    - attack.initial_access
    - attack.t1566.002
    - attack.user_execution
    - attack.t1204

// OTX 2026-11-07: Hunt for GTA VI lure domains and bank-phishing look-alike network access
// Covers published IOCs plus the urgency-keyword naming pattern from the 248-domain campaign
let GTA6Domains = dynamic(["gta6cyberleek.com","cyberleek.click","mygta6.icu","gta6keycodes.com","cyberleek.my","contact-rockstargames.com","cyberleek.cfd","cyberleek.world"]);
let BankPhishDomains = dynamic(["53primaryset.com","authorize-valley.com","commercial-atfirst.com","protect-pinnaclefp.com"]);
let BankPattern = @"(?i)(authorize|protect|verify|secure|alert|suspended|primary|commercial)-[a-z0-9-]+\.(com|net|org)$";
let GTAPattern = @"(?i)(cyberleek|gta6|gta-?vi|rockstargames)[a-z0-9-]*\.(icu|click|cfd|world|my|xyz|top)$";
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | extend Domain = tolower(RemoteUrl)
    | where Domain has_any (GTA6Domains) or Domain has_any (BankPhishDomains)
       or Domain matches regex BankPattern or Domain matches regex GTAPattern
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, Domain, RemoteIP, ActionType
    | extend Campaign = case(Domain has "cyberleek" or Domain has "gta6", "GTA VI Lure",
                             Domain has_any (BankPhishDomains), "Bank Phishing Network",
                             "Pattern Match")),
    (DnsEvents
    | where TimeGenerated > ago(14d)
    | extend Domain = tolower(Name)
    | where Domain has_any (GTA6Domains) or Domain has_any (BankPhishDomains)
       or Domain matches regex BankPattern or Domain matches regex GTAPattern
    | project TimeGenerated, ClientIP = ClientIP, Domain, IPAddresses
    | extend Campaign = "DNS Resolution")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count()
            by Domain, Campaign, DeviceName, InitiatingProcessAccountName
| order by Hits desc;
// Companion identity query: flag Azure/AWS sign-ins from hosts that touched lure domains
// Join the output above against SigninLogs / AWSCloudTrail for same-account activity within 4h

# OTX 2026-11-07 - Credential-Theft Campaign Hunt Script
# Checks for GTA VI lure execution artifacts, bank-phishing domain contact,
# infostealer-style persistence, and suspicious AWS credential usage indicators.
# Run elevated on endpoints; review output before remediation.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. DNS cache check for published OTX lure domains ---
$lureDomains = @(
    'gta6cyberleek.com','cyberleek.click','mygta6.icu','gta6keycodes.com',
    'cyberleek.my','contact-rockstargames.com','cyberleek.cfd','cyberleek.world',
    '53primaryset.com','authorize-valley.com','commercial-atfirst.com','protect-pinnaclefp.com'
)
$dnsCache = Get-DnsClientCache | Where-Object { $entry = $_.Entry; $lureDomains | Where-Object { $entry -like "*$_*" } }
if ($dnsCache) {
    $report += [pscustomobject]@{Check='DNS_LureDomain'; Severity='CRITICAL'; Detail=($dnsCache | Select-Object Entry, Data | Out-String)}
}

# --- 2. Browser download artifacts: trojanized APK / GTA VI executables ---
$userDirs = Get-ChildItem 'C:\Users' -Directory
foreach ($u in $userDirs) {
    $dl = Join-Path $u.FullName 'Downloads'
    $hits = Get-ChildItem $dl -Recurse -Include '*gta*6*','*gta*vi*','*cyberleek*','*.apk','*rockstar*launcher*' -File |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
    foreach ($h in $hits) {
        $report += [pscustomobject]@{Check='SuspiciousDownload'; Severity='HIGH'; Detail="$($h.FullName) | $($h.LastWriteTime)"}
    }
}

# --- 3. Infostealer persistence: Run keys with non-standard paths ---
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($rk in $runKeys) {
    $props = Get-ItemProperty $rk
    foreach ($p in $props.PSObject.Properties) {
        if ($p.Name -notmatch '^PS' -and $p.Value -match 'AppData|Temp|Public|ProgramData') {
            $report += [pscustomobject]@{Check='SuspiciousRunKey'; Severity='HIGH'; Detail="$rk :: $($p.Name) = $($p.Value)"}
        }
    }
}

# --- 4. Scheduled tasks masquerading as updaters (common stealer persistence) ---
$tasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'AppData|Temp' -and
    $_.TaskName -match 'update|sync|service|helper'
}
foreach ($t in $tasks) {
    $report += [pscustomobject]@{Check='SuspiciousScheduledTask'; Severity='MEDIUM'; Detail="$($t.TaskName) -> $($t.Actions.Execute)"}
}

# --- 5. AWS credential files accessed recently (token-jacking precursor) ---
foreach ($u in $userDirs) {
    $credFile = Join-Path $u.FullName '.aws\credentials'
    if (Test-Path $credFile) {
        $f = Get-Item $credFile
        if ($f.LastAccessTime -gt (Get-Date).AddDays(-7) -and $f.LastWriteTime -lt (Get-Date).AddDays(-7)) {
            $report += [pscustomobject]@{Check='AWSCredFileRecentAccess'; Severity='MEDIUM'; Detail="$credFile accessed $($f.LastAccessTime) - correlate with CloudTrail for GetCallerIdentity/ListFoundationModels"}
        }
    }
}

# --- 6. Active connections to known-bad VPS ranges / lure IPs (live triage) ---
$conns = Get-NetTCPConnection -State Established |
         Where-Object { $_.RemotePort -in 80,443 -and $_.OwningProcess -in ((Get-Process | Where-Object { $_.Path -match 'AppData|Temp' }).Id) }
foreach ($c in $conns) {
    $proc = (Get-Process -Id $c.OwningProcess).ProcessName
    $report += [pscustomobject]@{Check='SuspiciousOutboundConn'; Severity='HIGH'; Detail="$proc -> $($c.RemoteAddress):$($c.RemotePort)"}
}

if ($report.Count -eq 0) { Write-Output "[+] No indicators found on $env:COMPUTERNAME" }
else { $report | Sort-Object Severity | Format-Table -AutoSize | Out-String | Write-Output }